Weaknesses in Authentication Endpoint of RansomLook by RansomLook Inc.

CVE-2026-78551

What is CVE-2026-78551?

RansomLook contains critical vulnerabilities in its authentication mechanisms that permit unauthenticated remote attackers to exploit username enumeration, engage in unrestricted password-guessing attacks, and potentially exhaust the application's resources, resulting in a denial of service. The login implementation previously allowed attackers to discern valid usernames based on response times for authentication attempts. Moreover, the absence of rate limits on failed login attempts facilitated brute-force attacks. Security measures have been updated to mitigate these risks by standardizing response times and implementing rate-limiting controls based on client IP addresses, thus enhancing the application's resilience against attacks.

References